mirror of
https://github.com/netbirdio/netbird.git
synced 2024-11-23 16:43:29 +01:00
9bc7b9e897
This PR implements the following posture checks: * Agent minimum version allowed * OS minimum version allowed * Geo-location based on connection IP For the geo-based location, we rely on GeoLite2 databases which are free IP geolocation databases. MaxMind was tested and we provide a script that easily allows to download of all necessary files, see infrastructure_files/download-geolite2.sh. The OpenAPI spec should extensively cover the life cycle of current version posture checks.
153 lines
2.9 KiB
Go
153 lines
2.9 KiB
Go
package posture
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/netbirdio/netbird/management/server/peer"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestOSVersionCheck_Check(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
input peer.Peer
|
|
check OSVersionCheck
|
|
wantErr bool
|
|
isValid bool
|
|
}{
|
|
{
|
|
name: "Valid Peer Windows Kernel version",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "linux",
|
|
KernelVersion: "10.0.20348.2227",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Linux: &MinKernelVersionCheck{
|
|
MinKernelVersion: "10.0.20340.2200",
|
|
},
|
|
},
|
|
wantErr: false,
|
|
isValid: true,
|
|
},
|
|
{
|
|
name: "Valid Peer Linux Kernel version",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "linux",
|
|
KernelVersion: "6.1.1",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Linux: &MinKernelVersionCheck{
|
|
MinKernelVersion: "6.0.0",
|
|
},
|
|
},
|
|
wantErr: false,
|
|
isValid: true,
|
|
},
|
|
{
|
|
name: "Valid Peer Linux Kernel version with suffix",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "linux",
|
|
KernelVersion: "6.5.11-linuxkit",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Linux: &MinKernelVersionCheck{
|
|
MinKernelVersion: "6.0.0",
|
|
},
|
|
},
|
|
wantErr: false,
|
|
isValid: true,
|
|
},
|
|
{
|
|
name: "Not valid Peer macOS version",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "darwin",
|
|
OSVersion: "14.2.1",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Darwin: &MinVersionCheck{
|
|
MinVersion: "15",
|
|
},
|
|
},
|
|
wantErr: false,
|
|
isValid: false,
|
|
},
|
|
{
|
|
name: "Valid Peer ios version allowed by any rule",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "ios",
|
|
OSVersion: "17.0.1",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Ios: &MinVersionCheck{
|
|
MinVersion: "0",
|
|
},
|
|
},
|
|
wantErr: false,
|
|
isValid: true,
|
|
},
|
|
{
|
|
name: "Valid Peer android version not allowed by rule",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "android",
|
|
OSVersion: "14",
|
|
},
|
|
},
|
|
check: OSVersionCheck{},
|
|
wantErr: false,
|
|
isValid: false,
|
|
},
|
|
{
|
|
name: "Valid Peer Linux Kernel version not allowed by rule",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "linux",
|
|
KernelVersion: "6.1.1",
|
|
},
|
|
},
|
|
check: OSVersionCheck{},
|
|
wantErr: false,
|
|
isValid: false,
|
|
},
|
|
{
|
|
name: "Invalid Peer Linux kernel version",
|
|
input: peer.Peer{
|
|
Meta: peer.PeerSystemMeta{
|
|
GoOS: "linux",
|
|
KernelVersion: "x.y.1",
|
|
},
|
|
},
|
|
check: OSVersionCheck{
|
|
Linux: &MinKernelVersionCheck{
|
|
MinKernelVersion: "6.0.0",
|
|
},
|
|
},
|
|
wantErr: true,
|
|
isValid: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
isValid, err := tt.check.Check(tt.input)
|
|
if tt.wantErr {
|
|
assert.Error(t, err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
}
|
|
assert.Equal(t, tt.isValid, isValid)
|
|
})
|
|
}
|
|
}
|