mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
67043f53c9
Resolves #41478
- Generic changes file for the whole feature included in a previous PR.
- Tested with new changes in the proxy merged in
5a266bfaca.
## Testing
- [X] Added/updated automated tests
- [X] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [X] QA'd all new/changed functionality manually
292 lines
9.6 KiB
Go
292 lines
9.6 KiB
Go
package mysql
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestConditionalAccess(t *testing.T) {
|
|
ds := CreateMySQLDS(t)
|
|
|
|
cases := []struct {
|
|
name string
|
|
fn func(t *testing.T, ds *Datastore)
|
|
}{
|
|
{"Setup", testConditionalAccessSetup},
|
|
{"Hosts", testConditionalAccessHosts},
|
|
}
|
|
|
|
for _, c := range cases {
|
|
t.Helper()
|
|
t.Run(c.name, func(t *testing.T) {
|
|
defer TruncateTables(t, ds)
|
|
|
|
c.fn(t, ds)
|
|
})
|
|
}
|
|
}
|
|
|
|
func testConditionalAccessSetup(t *testing.T, ds *Datastore) {
|
|
ctx := context.Background()
|
|
|
|
_, err := ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar", "insecure")
|
|
require.NoError(t, err)
|
|
ca, err := ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar", ca.TenantID)
|
|
|
|
// ConditionalAccessMicrosoftCreateIntegration replaces the existing one.
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar2", "insecure2")
|
|
require.NoError(t, err)
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure2", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar2", ca.TenantID)
|
|
|
|
err = ds.ConditionalAccessMicrosoftMarkSetupDone(ctx)
|
|
require.NoError(t, err)
|
|
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.True(t, ca.SetupDone)
|
|
require.Equal(t, "insecure2", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar2", ca.TenantID)
|
|
|
|
err = ds.ConditionalAccessMicrosoftDelete(ctx)
|
|
require.NoError(t, err)
|
|
|
|
_, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
// Create a new one after deleting the existing.
|
|
err = ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar3", "insecure3")
|
|
require.NoError(t, err)
|
|
ca, err = ds.ConditionalAccessMicrosoftGet(ctx)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, ca)
|
|
require.False(t, ca.SetupDone)
|
|
require.Equal(t, "insecure3", ca.ProxyServerSecret)
|
|
require.Equal(t, "foobar3", ca.TenantID)
|
|
}
|
|
|
|
func testConditionalAccessHosts(t *testing.T, ds *Datastore) {
|
|
ctx := context.Background()
|
|
|
|
err := ds.ConditionalAccessMicrosoftCreateIntegration(ctx, "foobar", "insecure")
|
|
require.NoError(t, err)
|
|
|
|
// Test with non-existent host.
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, 999_999)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
noTeamHost := newTestHostWithPlatform(t, ds, "host1", "darwin", nil)
|
|
|
|
// Test with an existent host but no status yet.
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
// Nothing happens if the host doesn't have an entry yet.
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, false)
|
|
require.NoError(t, err)
|
|
_, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.Error(t, err)
|
|
require.True(t, fleet.IsNotFound(err))
|
|
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID", "foobar@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
|
|
s, err := ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
// When the status entry is created, these are not set yet.
|
|
// These values are updated during detail query ingestion.
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
// Execute with same values should do nothing.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID", "foobar@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
// These values are updated during detail query ingestion.
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, true, false)
|
|
require.NoError(t, err)
|
|
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.NotNil(t, s.Managed)
|
|
require.True(t, *s.Managed)
|
|
require.NotNil(t, s.Compliant)
|
|
require.False(t, *s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, true)
|
|
require.NoError(t, err)
|
|
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, s.Managed)
|
|
require.False(t, *s.Managed)
|
|
require.NotNil(t, s.Compliant)
|
|
require.True(t, *s.Compliant)
|
|
|
|
// Simulate a device changing its device ID and user principal name
|
|
// (e.g. log out from Entra on device and log in again).
|
|
// We should update its data and clear its statuses.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID2", "foobar2@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID2", s.DeviceID)
|
|
require.Equal(t, "foobar2@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, true)
|
|
require.NoError(t, err)
|
|
|
|
// Simulate a device with same device ID but empty username.
|
|
// This can happen on workstations with two user macOS accounts where one is registered and another one is not.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID2", "")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID2", s.DeviceID)
|
|
require.Equal(t, "", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, true)
|
|
require.NoError(t, err)
|
|
|
|
// Simulate now that the second user has logged in to Entra.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID2", "foobar3@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID2", s.DeviceID)
|
|
require.Equal(t, "foobar3@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
|
|
err = ds.SetHostConditionalAccessStatus(ctx, noTeamHost.ID, false, true)
|
|
require.NoError(t, err)
|
|
|
|
// Simulate that the first user has logged in again to the workstation.
|
|
err = ds.CreateHostConditionalAccessStatus(ctx, noTeamHost.ID, "entraDeviceID2", "foobar@example.onmicrosoft.com")
|
|
require.NoError(t, err)
|
|
s, err = ds.LoadHostConditionalAccessStatus(ctx, noTeamHost.ID)
|
|
require.NoError(t, err)
|
|
require.Equal(t, noTeamHost.ID, s.HostID)
|
|
require.Equal(t, "entraDeviceID2", s.DeviceID)
|
|
require.Equal(t, "foobar@example.onmicrosoft.com", s.UserPrincipalName)
|
|
require.Equal(t, "host1", s.DisplayName)
|
|
require.Equal(t, "15.4.1", s.OSVersion)
|
|
require.NotZero(t, s.CreatedAt)
|
|
require.NotZero(t, s.UpdatedAt)
|
|
require.Nil(t, s.Managed)
|
|
require.Nil(t, s.Compliant)
|
|
}
|
|
|
|
func TestExtractWindowsBuildVersion(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
expected string
|
|
}{
|
|
{
|
|
name: "Windows 10 Pro",
|
|
input: "Windows 10 Pro 22H2 10.0.19045.6456",
|
|
expected: "10.0.19045.6456",
|
|
},
|
|
{
|
|
name: "Windows Server 2025 Datacenter",
|
|
input: "Windows Server 2025 Datacenter 24H2 10.0.26100.32230",
|
|
expected: "10.0.26100.32230",
|
|
},
|
|
{
|
|
name: "no spaces",
|
|
input: "10.0.19045.6456",
|
|
expected: "10.0.19045.6456",
|
|
},
|
|
{
|
|
name: "empty string",
|
|
input: "",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "single word",
|
|
input: "Windows",
|
|
expected: "Windows",
|
|
},
|
|
{
|
|
name: "trailing whitespace",
|
|
input: "Windows 10 Pro 22H2 10.0.19045.6456 ",
|
|
expected: "10.0.19045.6456",
|
|
},
|
|
{
|
|
name: "leading whitespace",
|
|
input: " Windows 10 Pro 22H2 10.0.19045.6456",
|
|
expected: "10.0.19045.6456",
|
|
},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := extractWindowsBuildVersion(tt.input)
|
|
require.Equal(t, tt.expected, result)
|
|
})
|
|
}
|
|
}
|