mirror of
https://github.com/fleetdm/fleet
synced 2026-05-14 20:48:35 +00:00
d1992aa983
For #31048 This change includes some refactoring of orbit code. No functional changes. Moved non-Linux-specific code from `securehw_linux.go` to `securehw_tpm.go` so that tests on any platform can use it. There are no server changes impacting the upcoming 4.72 release. Just tests. # Checklist for submitter ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced a new TPM 2.0-based secure hardware interface, enabling creation, loading, and management of ECC keys within a TPM device. * Added support for both standard and RFC 9421-compatible HTTP signatures using TPM-backed keys. * **Bug Fixes** * Improved error handling and resource management for TPM operations. * **Tests** * Added comprehensive unit tests for TPM key file loading scenarios. * Introduced integration tests using a simulated TPM device to validate end-to-end secure hardware and SCEP workflows. * **Chores** * Updated dependencies for enhanced compatibility and security. * Modernized build constraints for improved maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
85 lines
2.4 KiB
Go
85 lines
2.4 KiB
Go
//go:build !windows
|
|
|
|
// Windows is disabled because the TPM simulator requires CGO, which causes lint failures on Windows.
|
|
|
|
package hostidentity
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/config"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/service"
|
|
"github.com/fleetdm/fleet/v4/server/service/integrationtest"
|
|
"github.com/go-kit/kit/log"
|
|
kitlog "github.com/go-kit/log"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// enrollOrbitResponse is the response structure for orbit enrollment
|
|
type enrollOrbitResponse struct {
|
|
OrbitNodeKey string `json:"orbit_node_key,omitempty"`
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
// orbitConfigRequest is used for orbit config endpoint requests
|
|
type orbitConfigRequest struct {
|
|
OrbitNodeKey string `json:"orbit_node_key"`
|
|
}
|
|
|
|
// osqueryConfigRequest is used for osquery config endpoint requests
|
|
type osqueryConfigRequest struct {
|
|
NodeKey string `json:"node_key"`
|
|
}
|
|
|
|
type Suite struct {
|
|
integrationtest.BaseSuite
|
|
}
|
|
|
|
func SetUpSuite(t *testing.T, uniqueTestName string, requireSignature bool) *Suite {
|
|
return SetUpSuiteWithConfig(t, uniqueTestName, requireSignature, nil)
|
|
}
|
|
|
|
func SetUpSuiteWithConfig(t *testing.T, uniqueTestName string, requireSignature bool, configModifier func(cfg *config.FleetConfig)) *Suite {
|
|
// Note: t.Parallel() is called when MySQL datastore options are processed
|
|
license := &fleet.LicenseInfo{
|
|
Tier: fleet.TierPremium,
|
|
}
|
|
ds, fleetCfg, fleetSvc, ctx := integrationtest.SetUpMySQLAndService(t, uniqueTestName, &service.TestServerOpts{
|
|
License: license,
|
|
})
|
|
|
|
// Apply config modifications
|
|
if configModifier != nil {
|
|
configModifier(&fleetCfg)
|
|
}
|
|
|
|
logger := log.NewLogfmtLogger(os.Stdout)
|
|
hostIdentitySCEPDepot, err := ds.NewHostIdentitySCEPDepot(kitlog.With(logger, "component", "host-id-scep-depot"), &fleetCfg)
|
|
require.NoError(t, err)
|
|
users, server := service.RunServerForTestsWithServiceWithDS(t, ctx, ds, fleetSvc, &service.TestServerOpts{
|
|
License: license,
|
|
FleetConfig: &fleetCfg,
|
|
Logger: logger,
|
|
HostIdentity: &service.HostIdentity{
|
|
SCEPStorage: hostIdentitySCEPDepot,
|
|
RequireHTTPMessageSignature: requireSignature,
|
|
},
|
|
})
|
|
|
|
s := &Suite{
|
|
BaseSuite: integrationtest.BaseSuite{
|
|
Logger: logger,
|
|
DS: ds,
|
|
FleetCfg: fleetCfg,
|
|
Users: users,
|
|
Server: server,
|
|
},
|
|
}
|
|
|
|
integrationtest.SetUpServerURL(t, ds, server)
|
|
|
|
s.BaseSuite.Token = s.BaseSuite.GetTestAdminToken(t)
|
|
return s
|
|
}
|