Merging Bitlocker feature branch (#14350)

This relates to #12577 --------- Co-authored-by: gillespi314 <73313222+gillespi314@users.noreply.github.com> Co-authored-by: Roberto Dip <dip.jesusr@gmail.com>
fleetdm · Oct 6, 2023 · f0d77ab · f0d77ab
1 parent cc547ba
commit f0d77ab
Show file tree

Hide file tree

Showing 136 changed files with 5,365 additions and 928 deletions.
diff --git a/changes/12927-disk-encryption-settings b/changes/12927-disk-encryption-settings
@@ -0,0 +1 @@
+* Deprecate `mdm.macos_settings.enable_disk_encryption` in favor of `mdm.enable_disk_encryption`
diff --git a/changes/12932-bitlocker-api-updates b/changes/12932-bitlocker-api-updates
@@ -0,0 +1,4 @@
+- Added `GET /mdm/disk_encryption/summary` endpoint to get the disk encryption summary for macOS and
+  Windows devices.
+- Added `os_settings` and `os_settings_disk_encryption` filters to `GET /hosts`, `GET /hosts/count`,
+  `GET /api/v1/fleet/labels/{id}/hosts` endpoints to filter hosts by OS settings.
diff --git a/changes/12933-bitlocker-host-details-api b/changes/12933-bitlocker-host-details-api
@@ -0,0 +1 @@
+- Added `mdm.os_settings` to `GET /api/v1/hosts/{id}` response.
diff --git a/changes/issue-13953-changes-to-controls-page-for-bitlocker b/changes/issue-13953-changes-to-controls-page-for-bitlocker
@@ -0,0 +1 @@
+- change Controls/Disk Encryption and host details page to include windows bitlocker information.
diff --git a/changes/issue-13954-orbit-disk-encryption-key b/changes/issue-13954-orbit-disk-encryption-key
@@ -0,0 +1 @@
+* Added the `POST /api/fleet/orbit/disk_encryption_key` endpoint for Windows hosts to report the bitlocker encryption key.
diff --git a/changes/issue-14007-support-get-windows-encryption-key b/changes/issue-14007-support-get-windows-encryption-key
@@ -0,0 +1 @@
+* Added support to return the decrypted disk encryption key of a Windows host.
diff --git a/cmd/fleet/cron.go b/cmd/fleet/cron.go
@@ -18,6 +18,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/policies"
 	"github.com/fleetdm/fleet/v4/server/ptr"
@@ -838,7 +839,7 @@ func verifyDiskEncryptionKeys(
 		if key.UpdatedAt.After(latest) {
 			latest = key.UpdatedAt
 		}
-		if _, err := apple_mdm.DecryptBase64CMS(key.Base64Encrypted, cert.Leaf, cert.PrivateKey); err != nil {
+		if _, err := mdm.DecryptBase64CMS(key.Base64Encrypted, cert.Leaf, cert.PrivateKey); err != nil {
 			undecryptable = append(undecryptable, key.HostID)
 			continue
 		}

diff --git a/cmd/fleetctl/apply_test.go b/cmd/fleetctl/apply_test.go
@@ -1044,13 +1044,13 @@ spec:
           foo: qux
     name: Team1
     mdm:
+      enable_disk_encryption: false
       macos_updates:
         minimum_version: 10.10.10
         deadline: 1992-03-01
       macos_settings:
         custom_settings:
           - %s
-        enable_disk_encryption: false
     secrets:
       - secret: BBB
 `, mobileConfigPath))
@@ -1062,9 +1062,9 @@ spec:
 	require.Equal(t, "[+] applied 1 teams\n", runAppForTest(t, []string{"apply", "-f", name}))
 	assert.JSONEq(t, string(json.RawMessage(`{"config":{"views":{"foo":"qux"}}}`)), string(*savedTeam.Config.AgentOptions))
 	assert.Equal(t, fleet.TeamMDM{
+		EnableDiskEncryption: false,
 		MacOSSettings: fleet.MacOSSettings{
-			CustomSettings:       []string{mobileConfigPath},
-			EnableDiskEncryption: false,
+			CustomSettings: []string{mobileConfigPath},
 		},
 		MacOSUpdates: fleet.MacOSUpdates{
 			MinimumVersion: optjson.SetString("10.10.10"),
@@ -1097,9 +1097,9 @@ spec:
 	require.True(t, ds.NewJobFuncInvoked)
 	// all left untouched, only setup assistant added
 	assert.Equal(t, fleet.TeamMDM{
+		EnableDiskEncryption: false,
 		MacOSSettings: fleet.MacOSSettings{
-			CustomSettings:       []string{mobileConfigPath},
-			EnableDiskEncryption: false,
+			CustomSettings: []string{mobileConfigPath},
 		},
 		MacOSUpdates: fleet.MacOSUpdates{
 			MinimumVersion: optjson.SetString("10.10.10"),
@@ -1129,9 +1129,9 @@ spec:
 	require.Equal(t, "[+] applied 1 teams\n", runAppForTest(t, []string{"apply", "-f", name}))
 	// all left untouched, only bootstrap package added
 	assert.Equal(t, fleet.TeamMDM{
+		EnableDiskEncryption: false,
 		MacOSSettings: fleet.MacOSSettings{
-			CustomSettings:       []string{mobileConfigPath},
-			EnableDiskEncryption: false,
+			CustomSettings: []string{mobileConfigPath},
 		},
 		MacOSUpdates: fleet.MacOSUpdates{
 			MinimumVersion: optjson.SetString("10.10.10"),
@@ -2886,7 +2886,7 @@ spec:
     macos_settings:
       enable_disk_encryption: true
 `,
-			wantErr: `Couldn't update macos_settings because MDM features aren't turned on in Fleet.`,
+			wantErr: `Couldn't edit enable_disk_encryption. Neither macOS MDM nor Windows is turned on`,
 		},
 		{
 			desc: "app config macos_settings.enable_disk_encryption false",

diff --git a/cmd/fleetctl/get.go b/cmd/fleetctl/get.go
@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/fatih/color"
+	"github.com/fleetdm/fleet/v4/pkg/rawjson"
 	"github.com/fleetdm/fleet/v4/pkg/secure"
 	kithttp "github.com/go-kit/kit/transport/http"
 	"gopkg.in/guregu/null.v3"
@@ -167,12 +168,15 @@ func (eacp enrichedAppConfigPresenter) MarshalJSON() ([]byte, error) {
 		*fleet.VulnerabilitiesConfig
 	}
 
-	return json.Marshal(&struct {
-		fleet.EnrichedAppConfig
+	enrichedJSON, err := json.Marshal(fleet.EnrichedAppConfig(eacp))
+	if err != nil {
+		return nil, err
+	}
+
+	extraFieldsJSON, err := json.Marshal(&struct {
 		UpdateInterval  UpdateIntervalConfigPresenter  `json:"update_interval,omitempty"`
 		Vulnerabilities VulnerabilitiesConfigPresenter `json:"vulnerabilities,omitempty"`
 	}{
-		EnrichedAppConfig: fleet.EnrichedAppConfig(eacp),
 		UpdateInterval: UpdateIntervalConfigPresenter{
 			eacp.UpdateInterval.OSQueryDetail.String(),
 			eacp.UpdateInterval.OSQueryPolicy.String(),
@@ -184,6 +188,13 @@ func (eacp enrichedAppConfigPresenter) MarshalJSON() ([]byte, error) {
 			eacp.Vulnerabilities,
 		},
 	})
+	if err != nil {
+		return nil, err
+	}
+
+	// we need to marshal and combine both groups separately because
+	// enrichedAppConfig has a custom marshaler.
+	return rawjson.CombineRoots(enrichedJSON, extraFieldsJSON)
 }
 
 func printConfig(c *cli.Context, config interface{}) error {

diff --git a/cmd/fleetctl/get_test.go b/cmd/fleetctl/get_test.go
@@ -7,7 +7,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -168,15 +167,15 @@ func TestGetTeams(t *testing.T) {
 				}, nil
 			}
 
-			b, err := ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsText.txt"))
+			b, err := os.ReadFile(filepath.Join("testdata", "expectedGetTeamsText.txt"))
 			require.NoError(t, err)
 			expectedText := string(b)
 
-			b, err = ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsYaml.yml"))
+			b, err = os.ReadFile(filepath.Join("testdata", "expectedGetTeamsYaml.yml"))
 			require.NoError(t, err)
 			expectedYaml := string(b)
 
-			b, err = ioutil.ReadFile(filepath.Join("testdata", "expectedGetTeamsJson.json"))
+			b, err = os.ReadFile(filepath.Join("testdata", "expectedGetTeamsJson.json"))
 			require.NoError(t, err)
 			// must read each JSON value separately and compact it
 			var buf bytes.Buffer
@@ -206,8 +205,8 @@ func TestGetTeams(t *testing.T) {
 			errBuffer.Reset()
 			actualJSON, err := runWithErrWriter([]string{"get", "teams", "--json"}, &errBuffer)
 			require.NoError(t, err)
-			require.Equal(t, expectedJson, actualJSON.String())
 			require.Equal(t, errBuffer.String() == expiredBanner.String(), tt.shouldHaveExpiredBanner)
+			require.Equal(t, expectedJson, actualJSON.String())
 
 			errBuffer.Reset()
 			actualYaml, err := runWithErrWriter([]string{"get", "teams", "--yaml"}, &errBuffer)
@@ -433,7 +432,7 @@ func TestGetHosts(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			expected, err := ioutil.ReadFile(filepath.Join("testdata", tt.goldenFile))
+			expected, err := os.ReadFile(filepath.Join("testdata", tt.goldenFile))
 			require.NoError(t, err)
 			expectedResults := tt.scanner(string(expected))
 			actualResult := tt.scanner(runAppForTest(t, tt.args))
@@ -536,7 +535,7 @@ func TestGetHostsMDM(t *testing.T) {
 			}
 
 			if tt.goldenFile != "" {
-				expected, err := ioutil.ReadFile(filepath.Join("testdata", tt.goldenFile))
+				expected, err := os.ReadFile(filepath.Join("testdata", tt.goldenFile))
 				require.NoError(t, err)
 				if ext := filepath.Ext(tt.goldenFile); ext == ".json" {
 					// the output of --json is not a json array, but a list of

diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
@@ -85,6 +85,7 @@
       "enabled_and_configured": false,
       "apple_bm_default_team": "",
       "windows_enabled_and_configured": false,
+      "enable_disk_encryption": false,
       "macos_updates": {
         "minimum_version": null,
         "deadline": null
@@ -95,8 +96,7 @@
         "webhook_url": ""
       },
       "macos_settings": {
-        "custom_settings": null,
-        "enable_disk_encryption": false
+        "custom_settings": null
       },
       "macos_setup": {
         "bootstrap_package": null,

diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
@@ -19,6 +19,7 @@ spec:
     enabled_and_configured: false
     apple_bm_default_team: ""
     windows_enabled_and_configured: false
+    enable_disk_encryption: false
     macos_migration:
       enable: false
       mode: ""
@@ -28,7 +29,6 @@ spec:
       deadline: null
     macos_settings:
       custom_settings:
-      enable_disk_encryption: false
     macos_setup:
       bootstrap_package:
       enable_end_user_authentication: false

diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
@@ -43,6 +43,7 @@
       "apple_bm_enabled_and_configured": false,
       "enabled_and_configured": false,
       "windows_enabled_and_configured": false,
+      "enable_disk_encryption": false,
       "macos_updates": {
         "minimum_version": null,
         "deadline": null
@@ -53,8 +54,7 @@
         "webhook_url": ""
       },
       "macos_settings": {
-        "custom_settings": null,
-        "enable_disk_encryption": false
+        "custom_settings": null
       },
       "macos_setup": {
         "bootstrap_package": null,

diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
@@ -19,6 +19,7 @@ spec:
     apple_bm_terms_expired: false
     enabled_and_configured: false
     windows_enabled_and_configured: false
+    enable_disk_encryption: false
     macos_migration:
       enable: false
       mode: ""
@@ -28,7 +29,6 @@ spec:
       deadline: null
     macos_settings:
       custom_settings:
-      enable_disk_encryption: false
     macos_setup:
       bootstrap_package:
       enable_end_user_authentication: false

diff --git a/cmd/fleetctl/testdata/expectedGetTeamsJson.json b/cmd/fleetctl/testdata/expectedGetTeamsJson.json
@@ -24,13 +24,13 @@
 				"enable_software_inventory": true
 			},
 			"mdm": {
+				"enable_disk_encryption": false,
 				"macos_updates": {
 					"minimum_version": null,
 					"deadline": null
 				},
 				"macos_settings": {
-					"custom_settings": null,
-					"enable_disk_encryption": false
+					"custom_settings": null
 				},
 				"macos_setup": {
 					"bootstrap_package": null,
@@ -84,13 +84,13 @@
 				}
 			},
 			"mdm": {
+				"enable_disk_encryption": false,
 				"macos_updates": {
 					"minimum_version": "12.3.1",
 					"deadline": "2021-12-14"
 				},
 				"macos_settings": {
-					"custom_settings": null,
-					"enable_disk_encryption": false
+					"custom_settings": null
 				},
 				"macos_setup": {
 					"bootstrap_package": null,

diff --git a/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml b/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml
@@ -7,12 +7,12 @@ spec:
       enable_host_users: true
       enable_software_inventory: true
     mdm:
+      enable_disk_encryption: false
       macos_updates:
         minimum_version: null
         deadline: null
       macos_settings:
         custom_settings:
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package:
         enable_end_user_authentication: false
@@ -36,12 +36,12 @@ spec:
       enable_host_users: false
       enable_software_inventory: false
     mdm:
+      enable_disk_encryption: false
       macos_updates:
         minimum_version: "12.3.1"
         deadline: "2021-12-14"
       macos_settings:
         custom_settings:
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package:
         enable_end_user_authentication: false

diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
@@ -19,13 +19,13 @@ spec:
     apple_bm_terms_expired: false
     enabled_and_configured: true
     windows_enabled_and_configured: false
+    enable_disk_encryption: false
     macos_migration:
       enable: false
       mode: ""
       webhook_url: ""
     macos_settings:
       custom_settings: null
-      enable_disk_encryption: false
     macos_setup:
       bootstrap_package: null
       enable_end_user_authentication: false

diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
@@ -19,13 +19,13 @@ spec:
     apple_bm_terms_expired: false
     enabled_and_configured: true
     windows_enabled_and_configured: false
+    enable_disk_encryption: false
     macos_migration:
       enable: false
       mode: ""
       webhook_url: ""
     macos_settings:
       custom_settings: null
-      enable_disk_encryption: false
     macos_setup:
       bootstrap_package: %s
       enable_end_user_authentication: false

diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml
@@ -7,9 +7,9 @@ spec:
       enable_host_users: true
       enable_software_inventory: true
     mdm:
+      enable_disk_encryption: false
       macos_settings:
         custom_settings: null
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package: null
         enable_end_user_authentication: false
@@ -27,9 +27,9 @@ spec:
       enable_host_users: true
       enable_software_inventory: true
     mdm:
+      enable_disk_encryption: false
       macos_settings:
         custom_settings: null
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package: null
         macos_setup_assistant: null

diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml
@@ -7,9 +7,9 @@ spec:
       enable_host_users: true
       enable_software_inventory: true
     mdm:
+      enable_disk_encryption: false
       macos_settings:
         custom_settings: null
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package: %s
         enable_end_user_authentication: false
@@ -27,9 +27,9 @@ spec:
       enable_host_users: false
       enable_software_inventory: false
     mdm:
+      enable_disk_encryption: false
       macos_settings:
         custom_settings: null
-        enable_disk_encryption: false
       macos_setup:
         bootstrap_package: %s
         macos_setup_assistant: %s
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		* Deprecate `mdm.macos_settings.enable_disk_encryption` in favor of `mdm.enable_disk_encryption`
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- Added `mdm.os_settings` to `GET /api/v1/hosts/{id}` response.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- change Controls/Disk Encryption and host details page to include windows bitlocker information.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		* Added the `POST /api/fleet/orbit/disk_encryption_key` endpoint for Windows hosts to report the bitlocker encryption key.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		* Added support to return the decrypted disk encryption key of a Windows host.