mirror of
https://github.com/fleetdm/fleet
synced 2026-05-21 07:58:31 +00:00
0180cc8086
Fixes #30458 Contributor docs PR: https://github.com/fleetdm/fleet/pull/30651 # Checklist for submitter - We will add changes file later. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [x] If database migrations are included, checked table schema to confirm autoupdate - For database migrations: - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). - [x] Added/updated automated tests - Did not do manual QA since the SCEP client I have doesn't support ECC. Will rely on next subtasks for manual QA. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced Host Identity SCEP (Simple Certificate Enrollment Protocol) support, enabling secure host identity certificate enrollment and management. * Added new API endpoints for Host Identity SCEP, including certificate issuance and retrieval. * Implemented MySQL-backed storage and management for host identity SCEP certificates and serials. * Added new database tables for storing host identity SCEP certificates and serial numbers. * Provided utilities for encoding certificates and keys, and handling ECDSA public keys. * **Bug Fixes** * None. * **Tests** * Added comprehensive integration and unit tests for Host Identity SCEP functionality, including certificate issuance, validation, and error scenarios. * **Chores** * Updated test utilities to support unique test names and new SCEP storage options. * Extended mock datastore and interfaces for new host identity certificate methods. * **Documentation** * Added comments and documentation for new SCEP-related interfaces, methods, and database schema changes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
50 lines
1.5 KiB
Go
50 lines
1.5 KiB
Go
package hostidentity
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/fleetdm/fleet/v4/pkg/certificate"
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/mdm/scep/depot"
|
|
)
|
|
|
|
func initAssets(ds fleet.Datastore) error {
|
|
// Check if we have existing certs and keys
|
|
expectedAssets := []fleet.MDMAssetName{
|
|
fleet.MDMAssetHostIdentityCACert,
|
|
fleet.MDMAssetHostIdentityCAKey,
|
|
}
|
|
savedAssets, err := ds.GetAllMDMConfigAssetsByName(context.Background(), expectedAssets, nil)
|
|
if err != nil {
|
|
// allow not found errors as it means we're generating the assets for the first time.
|
|
if !fleet.IsNotFound(err) {
|
|
return fmt.Errorf("loading existing host identity assets from the database: %w", err)
|
|
}
|
|
}
|
|
|
|
if len(savedAssets) != len(expectedAssets) {
|
|
// Then we should create them
|
|
scepCert, scepKey, err := depot.NewSCEPCACertKey()
|
|
if err != nil {
|
|
return fmt.Errorf("generating host identity SCEP cert and key: %w", err)
|
|
}
|
|
|
|
// Store our config assets encrypted
|
|
var assets []fleet.MDMConfigAsset
|
|
for k, v := range map[fleet.MDMAssetName][]byte{
|
|
fleet.MDMAssetHostIdentityCACert: certificate.EncodeCertPEM(scepCert),
|
|
fleet.MDMAssetHostIdentityCAKey: certificate.EncodePrivateKeyPEM(scepKey),
|
|
} {
|
|
assets = append(assets, fleet.MDMConfigAsset{
|
|
Name: k,
|
|
Value: v,
|
|
})
|
|
}
|
|
|
|
if err := ds.InsertMDMConfigAssets(context.Background(), assets, nil); err != nil {
|
|
return fmt.Errorf("inserting host identity SCEP assets: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|